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Binding Corporate Rules at the end of the 
transition period 


This statement is for organisations who currently rely on EU Binding 
Corporate Rules (EU BCRs) as an appropriate safeguard for international 
transfers from the EEA. 


The UK has left the EU and entered a transition period which ends on 31 
December 2020. Once the transition period ends, the GDPR will be retained 
in domestic law as the UK GDPR. The UK will be a third country for the 
purposes of the EU GDPR and the ICO will no longer be a supervisory 
authority for EU BCRs. The Information Commissioner will introduce and 
approve UK GDPR Binding Corporate Rules (UK BCRs) to enable data 
transfers from the UK. 


Whether or not you may continue to rely on EU BCRs as an appropriate 
safeguard for data transfers from the EEA after the transition period ends will 
depend on the circumstances in which the BCRs were approved, and the 
action you have taken to ensure that they remain valid. You may also be 
eligible for a UK BCR from 1 January 2021. 


Continuing transfers from the EEA: 


EU Binding Corporate Rules authorised under Article 26(2) of 
Directive 95/46/EC where the ICO was the lead supervisory 
authority. 

Holders of EU BCRs where the ICO was the lead supervisory authority must 
identify an EEA supervisory authority to act as their new lead for their EU 
BCRs and must have transferred to them before the end of the transition 
period. If this is not done their EU BCR will no longer be valid under EU law. 


The EDPB have adopted an information note explaining the measures that 
need to be taken. 


Continuing transfers from the UK: 


EU Binding Corporate Rules authorised under Article 26(2) of 
Directive 95/46/EC where the Information Commissioner 
issued an authorisation (whether ICO was the lead supervisory 
authority or not). 


Holders of EU BCRs for which the Information Commissioner issued an 
authorisation under Directive 95/46/EC will be automatically eligible for a UK 
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BCR under paragraph 9, Part 3, Schedule 21 to the DPA 2018 (as amended 
from 1 January 2021). 


Each such BCR holder needs to produce a UK version of their BCRs by 1 
January 2021 to incorporate the changes described in that paragraph. The 
UK version of the BCRs must be provided to the ICO on or before the next 
annual update due date. 


The ICO will contact each relevant organisation after the end of the transition 
period to confirm their UK BCR status and seek assurances that the 
necessary amendments have been made. 


If the amended documentation is not provided to ICO’s satisfaction, the 
Information Commissioner may revoke the UK BCR authorisation. 


EU Binding Corporate Rules authorised under Article 26(2) of 
Directive 95/46/EC where the ICO was not the lead supervisory 
authority and did not issue an authorisation. 


Holders of EU BCRs for which the ICO did not act as lead and did not issue an 
authorisation will be eligible automatically for a UK BCR only if certain 
conditions are met. 


These conditions are: 


e their entity established in the UK must notify the ICO that they have 
an EU BCR and wish to have a UK BCR; 

e they must provide the name and contact details of their DPO or other 
relevant contact; and 

e they must supply such additional information the ICO reasonably 
requires. 


The ICO will expect to receive a UK version of the BCRs incorporating the 
changes described in paragraph 9, Part 3, Schedule 21, the DPA 2018 (as 
amended from 1 January 2021). The conditions should be satisfied as soon 
as possible and, in any event, before 30 June 2021, as no confirmation of UK 
BCR will be issued by Information Commissioner until they are. These BCR 
holders have until 30 June 2021 at the latest to provide this information. 


Holders of these EU BCRs should contact the ICO as soon as possible if they 
require a UK BCR to discuss the process and the ICO’s exact requirements. 


Please contact BCR@ico.org.uk. 


EU Binding Corporate Rules approved under EU GDPR where 
the ICO was not the lead supervisory authority 


These BCRs are not covered by paragraph 9, Part 3, Schedule 21 to the DPA 
2018 (as amended from 1 January 2021). Holders of these EU BCRs must 
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contact the ICO as soon as possible if they require a UK BCR to discuss the 
process and ICO’s requirements. Please contact BCR@ico.org.uk. 


